HP SIM and WBEM Indications

[Rob Buxton]

Hi All,
Recently David C. asked for some comments on wbem. As a result I started to play with wbem a bit more on a couple of servers.
I finally got wbem to correctly identify and report on our ESXi V4 server. I had to delete and re-add the server into HP SIM and restart the ESXi server to get ID and other things to work correctly.

I also started to try and get wbem indications to report back to HPSIM. From our ESXi server I get a notification: WBEM Providers Started. Turning to windows I see there's a Test WMI Events. All this seems to do is generate an event in the NT Events for the server.
On all servers I've subscribed to WBEM Indications in HPSIM and the data source is WBEM.

So a couple of quick questions:
Are wbem indications meant to work on Windows servers yet?
What do others see if the Test WBEM Events option is selected?

There's not a lot of documentation on wbem around. The bulk of the detailed material I've found is related to HP-UX. While the general description of wbem is useful, it doesn't help when trying to understand how wbem will work on either Windows or ESXi environments.
Anyone found good links to wbem material for ESXi or Windows?

[NJK-Work]

I believe I tested WBEM subscriptions but never got them to work. I too ran the Test WMI events tool and only got an event log entry. I never recieved a test alert in SIM for it.

I know I sound like a broken record (based on my previous posts on this matter), but I have pretty much given up on WBEM for management with SIM. It's just not there yet and a lot more painful than SNMP. But I do have to use it for Virtual Machines as HP does not provide (free) agents for VMs.

Nelson

[Steven Petrillo]

I have seen soo many questions on this, with hardly any real information. So please pardon me if I am asking a redundant question.

Are you both stating that WEBEM on ESX/Windows is not the way to go? SNMP is the preferred method for now?

Steve

[NJK-Work]

I have found no value in the "HP Insight Management WBEM Providers for Windows Server" and do not even install them any more. Virtual Machines I just use the native WMI access since niether the HP SNMP Management agents or the HP Insight Management WBEM Providers for Windows Server can be installed on a virtual machine.

But that is just me. Other people may be completely happy with the WBEM provicers.

Nelson

[Rob Buxton]

On Windows physical servers, with the testing I've done and the information I've found you will need SNMP to send traps from the agents to HPSIM. I've now found that wbem provides about as much information as SNMP via the SMH. I've not done a side by side comparison though. Wbem does seem to be improving.
On Windows virtual servers we let wbem identify the server. We do not use VMM any more.
On ESX we use SNMP only. We have actively disabled the Pegasus service on our ESX boxes as there is an issue where the process was hanging the host server. There's been no resolution to that and it was still there in ESX 3.5U5. It's not widespread so it may be related to our hardware,
On ESXi you still have access to both wbem and snmp. But I have not been able get detailed information back into HPSIM from SNMP. For ESXi I have had to add the HP ESXi offline bundle to the host and then configure it. I've now got reporting back from ESXi using WBEM. Unknown at this point is whether hardware alerts would get back to the HP SIM Server via SNMP. A test trap does work from ESXi.
I would like to see more clear documentation on wbem and how to configure servers for it. I've done most of my stuff through trial and error and finding odd snippets of info. here and there.

[UK-Blr]

pegasus service in esx, many times reboots the esx server automatically.

Best thing to do in esx is to run a cron job to restart every hours / every day.

This fixes the server hung, as well as pink screen PSOD!!

[UK-Blr]

pegasus service in esx, many times reboots the esx server automatically.

Best thing to do in esx is to run a cron job to restart every hours / every day.

This fixes the server hung, as well as pink screen PSOD!!

-UK

[Rob Buxton]

UK - did you ever log a call with Vmware over that?
I got the impression there were not many other sites having an issue with the Pegasus service.

[UK-Blr]

yep, i have logged one very long ago.
There is an article on this issue in vmware kb...
kb.vmware.com/kb/1009607

[Rob Buxton]

OK - we actually eliminated that one as our conditions and errors in the log were different. But thanks for the link.

[Olivier Masse]

I'm one (of the few, I think) that made WBEM indications work as expected with Windows.

Being an HP-UX admin I've never been fond of WBEM. But from what I understand, the newer Insight Agents for Windows and System Management Homepage now set up WBEM by default instead of SNMP... thus the Windows team here started deploying it magically and I had no choice of supporting it with SIM.

Here are the things I had to do to make it work:

1. Reconfigure the WMI proxy on the CMS correctly, as it didn't work initially at my site.

2. Have a locked-down service account created specifically for WBEM authentication on all Windows servers, since I didn't want to have to use an admin account. It needs to be part of a specific group I don't remember; it's documented somewhere by HP.

3. Run this on the managed system: "C:\Program Files\HPWBEM\Tools>enableRWMI.exe -a:MY_DOMAIN\my_wbem_account". This authorizes my_wbem_account to be able to remotely gather WBEM data.

Good luck

Olivier.

[Rob Buxton]

Olivier,
But have you got wbem indications to work? And how did you test?
I can get data via wbem and subscribe to wbem events.
But I've never seen a wbem generated event in the servers I've subscribed to.
On our ESXi servers, when they restart I get an event saying the wbem providers have started. I get nothing similar from a windows server and the Test WMI utility just seems to generate an event in the NT Events log.

[Olivier Masse]

Rob,

I've used WBEM only on HP-UX and Windows so far. Both platforms have a way to send test indications to simulate a hardware failure, and everything works as expected. I couldn't say for ESXi, I only have ESX here and use SNMP on that platform.

Olivier

[Olivier Masse]

Rob, I had a doubt, so I tried it again and was mistaken. It does NOT work completely.

When sending a test indication from SMH, RemoteSupport diagnoses it correctly, opens a service event at HP and logs it in SIM's event viewer. However, SIM by itself doesn't say a word about the event.

So there are still some missing pieces at my site too.

[Rob Buxton]

Olivier,
That's interesting hadn't thought to check at the HP site.
We use the Enterprise variant of the RSP. Tried logging onto the HP site this a.m but it's having problems. Just trying to confirm if anything got through to HP from our set up.

But I would like to see the visibility within HPSIM for this - that's why we have it!
Rob.

[Olivier Masse]

It actually _tries_ to open an event at HP. The event it closed immediately with not ticket number, which is the correct behaviour with test events.

But there is a short message in the event log saying that an event has been opened (screenshot attached). Nothing else in SIM.

Only the WBEM Windows client I tested does this; I have 60+ HP-UX clients that use WBEM and they work fine with complete event reporting in SIM when I send test indications.

[Rob Buxton]

Do you see those events in a Windows Server? Or just the HP-UX.
The only activity I see is in the Windows Event Log, nothing in the HPSIM events.

[Olivier Masse]

My CMS runs on Windows and monitors both Windows and HP-UX servers. The screenshot shows I see in SIM when Windows servers send a test indication (two tests in fact in this screenshot). When HP-UX servers send indications, I get the same output along with another entry from SIM giving a descriptive message of the event.

Time for me to leave the office, but I can provide a comparative screenshot of both platforms tomorrow.

Bye

[Olivier Masse · Accepted solution]

I fixed it. Looks like asking SIM to re-subscribe to WBEM events from managed Windows clients won't do any good if there is already a subscription in place and it happens that it's not correctly set.

To confirm your subscriptions are in order, do this on the CMS: "mxwbemsub -l -n "

This will list current active subscriptions on the managed system. If there are no subscriptions or if the IP addresses in them is incorrect (which was my case), you first need to delete them with "mxwbemsub -r -n ", THEN resubscribe with "mxwbemsub -a -n ".

SIM's "events" log for the Windows system I tested now returns an error event with a proper description, and the RemoteSupport plug-in logs that "A service incident has been reported".

So now I can announce with, say, 85% confidence, that WBEM indications from Windows hosts work as expected.

Olivier

[Rob Buxton]

Olivier,
Interesting - I do not see that behaviour with the testing I'm doing.
I've subscribed a new server and when I use the -l qualifier it shows two indicators. One for HP_AlertIndication and HP_ThresholdIndication.
In both cases the IP listed is the IP address of the CMS.
I then go to the HP WBEM Event test Tool, and generate an "Error" Event. This error shows in the System part of the Windows Events log, but nothing appears in HPSIM.
As part of your RSP installation do you have anything that interprets the Windows Event logs?
Tried this on several servers, including those with the most recent a version of HP PSP.

[Olivier Masse]

Rob, if you haven't read this document, I suggest you take a look:
http://h20000.www2.hp.com/bc/docs/support/SupportManual/c01509052/c01509052.pdf

It has a section on what to verify if WBEM indications don't show up in SIM's event log.

Olivier

[Rob Buxton]

Olivier,
Thanks that is a good document. I hadn't set the "Accept unregistered events". But even after setting that I'm not getting the indications through.
In the document the format of the mxwbemsub -l output doesn't tally with mine.
I have something like:

https://10.7.39.19:50004/targetserver.ourco.nz?wbemip=10.7.39.19

In the example in the doc. the IP addresses listed are different for the https and wbemip. Not sure how hat could be unless there's something wrong with our subscriptions.

[Rob Buxton]

The document Olivier pointed to was invaluable. We had two issues preventing this from working.
We had not selected to "Accept unregistered events"
I also found that while we had the Pegasus WMI Mapper service running we did not have the Pegasus WMIMapper Indications service installed and running. The fix for that was to remove the Pegasus WMI Mapper and reinstall using the commandline wmimapper.msi INDICATIONSSUPPORT=yes

Once all that was done then we correctly received notifications from the Windows Servers.

[Mazda]

Rob,

So do you get anything more by using WBEM or you just wanted to standardise? Why go through all of this effort to change from SNMP?

Cheers

[Rob Buxton]

Really just wanted to fully understand the process.
The trend seems to be about moving to wbem. So rather than get caught I thought I'd try and get a better understanding of all the mechanisms.
Certainly don't get more from wbem at this stage, except for our vmware esxi servers which are wbem only.